Presently, many systems employ security measures to protect proprietary or highly sensitive information they possess. One common aspect of the security measures often includes authentication (i.e., the establishment of identity) of subjects that are using the system. As used herein, the term “subject” refers to any person or entity being authenticated. There are two primary types of authentication: user authentication and data authentication. User authentication is the process of determining whether the subject is who he claims to be. There are many possible ways of determining subject identity, and they come with varying degrees of security. Traditionally, subject authentication has been done in three ways: recognition of the subject, shared knowledge, and possession of a token by the subject.
When implementing shared knowledge for subject authentication, the system knows things about the subject that should not be common knowledge. When the subject demonstrates that he also knows these things, identification is achieved. The information typically used in the authentication procedures can be divided into two types: in-wallet data and out-of-wallet data. In-wallet data is information you know about yourself or can readily put your hand to. It includes your name, address, telephone number, drivers license number, social security number, checking account number, credit card numbers, mother's maiden name, and the like. This data forms the basis for some of the simpler authentication systems of the prior art.
Out-of-wallet data is information about you that would take you a little effort to find out, but that you probably have in your filing system or somewhere equally accessible with some effort. It includes information such as the amount of the last transaction with your checkbook or credit card, the holder and amount of your mortgage, your credit rating, your bank balance, and the like. Incorporating out-of-wallet information into an authentication system is more complicated, and thus, it is found less frequently in typical systems.
Passwords are a form of both shared knowledge and of tokens. For a password to work properly, both sides must know it, and only both sides must know it. Shared knowledge includes some nonobvious information as well. The billing address on your credit card, for example, is known to you, of course, but is accessible from the card issuer by any merchant who takes that credit card.
When performing a transaction, it is often necessary to fill out a form containing information important for the transaction. Quite apart from the need to authenticate the subject, the data in those forms must also be authenticated. Data authentication consists of applying business rules to the forms at the time of capture. This is done at the point of recognition for paper forms, and while the subject is online, in the case of Web forms. Data authentication can be as simple as ensuring a column of numbers adds up, or as complicated as verifying several associated tax forms to be sure a particular number was both correctly calculated and correctly copied.
In addition to attempting to overcome technological hurdles, typical authentication systems of the prior art must frequently overcome social hurdles as well. Many people are concerned with the growing availability of personal information on the Internet. There are equal concerns around too much information being stored in one place. This is especially true when the information is being stored by a governmental entity, raising “big brother” concerns. An authentication system based on shared information is more convenient and less expensive for the subject, but it is more invasive of privacy. A system based on shared information can only work when based on information that only the subject and the authenticator knows. Because the subject and the authenticator have no contact other than the current transaction, this means that the shared information must be private information about the subject that the authenticator also possesses.
Although everyone would prefer to keep private information in the hands of the subject, the alternative to using it is identity theft. A system that works entirely online, if denied access to private information, will be exposed to identity theft. One simply cannot prevent identity theft without some form of authentication. It is also clear that the security of an authentication system and its obtrusiveness are inversely related—the more secure the system, the harder it is to make it unobtrusive. This tension inherent in authentication processes illustrates one of the limitations of proposals such as the “national identity card.” There are various proposed uses for such a card, but primary among them are prevention of identity theft, limiting social benefits to legal residents, tracking those derelict in child support and other payments, fighting drug trafficking, providing identification for travelers, and making it easier to track those in this country legally or illegally.
Each of these is a legitimate social concern. Nonetheless, any system based on a single card allowing access to a centralized source of identity-establishing information suffers from two important drawbacks. The first, is establishing that a presented card is itself legitimate. Although states recently have taken measures to protect their driver's licenses and ID cards from forgery, fake ID cards are a long-standing problem. It is, for example, very difficult to establish from an ID card whether two people who look alike are actually distinct individuals.
The security needs of both the nation and the individual citizens must always be balanced against the requirement to preserve a free and open society. Authentication system, as viewed on the whole, should not be deemed overly intrusive.